Aave DIVA Wrapper
DIVA
HardhatDeFi
15,000 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

Incorrect Yield Accounting

0xdaxun

Summary

The _claimYield function in AaveDIVAWrapperCore.sol does not track principal over time, allowing the owner to repeatedly claim the same yield.

Vulnerability Details

  • Location: AaveDIVAWrapperCore.sol

  • Code:

    function _claimYield(...) internal {
    uint256 yield = _getAccruedYieldPrivate(_collateralToken);
    IAave(_aaveV3Pool).withdraw(_collateralToken, yield, _recipient);
    }

  • Issue: Yield is calculated as aTokenBalance - wTokenSupply, which does not account for previously claimed yield.

Impact

  • Critical: The owner can repeatedly claim the same yield, draining funds from the contract.

Tools Used

  • Manual code review.

Recommendations

Track principal per collateral token:

mapping(address => uint256) private principal;
​
function _claimYield(...) internal {
uint256 currentBalance = aToken.balanceOf(address(this));
uint256 yield = currentBalance - principal[_collateralToken];
principal[_collateralToken] = currentBalance;
IAave(_aaveV3Pool).withdraw(_collateralToken, yield, _recipient);
}
Updates

Lead Judging Commences

bube Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!